Auditing Future-Memory Use in Point-in-Time Language Agents
Organizations: Department of Computer Science, Aalto University
Abstract
Point-in-time (PIT) agents can recall post-cutoff facts even when their external evidence respects a historical cutoff. We examine whether this access predicts evidence gathering in 48 historical company-comparison tasks. Independent closed-book revenue probes identify the better-remembered company for each model on tasks with unequal recall, fixing the predicted direction before agent runs. We then compare paired runs with real or anonymized company identities while keeping external evidence PIT-valid. Both Qwen and DeepSeek recalled future facts, but neither supported the prespecified shift toward the better-remembered company. Qwen's four allocation estimates on 28 unequal-recall tasks were negative, with descriptive intervals spanning zero. A prospective DeepSeek replication showed an inverse pattern across all four metrics on 20 such tasks, with intervals below zero. These estimates remained negative after each company, pair, and future-fact omission, and all four post-hoc max-T-adjusted sign-flip p-values were below .05. In a prospectively specified follow-up, explicit future facts produced small estimated shifts away from the supplied-fact company, with intervals spanning zero, while final choices shifted toward it. The mechanism behind the natural inverse pattern remains unresolved. These findings support separate assessments of memory accessibility, search allocation, and final outputs alongside cutoff checks on external evidence.
Figures & tables
| Analysis | Status | Finding |
|---|---|---|
| Qwen original audit | Confirmatory; two-probe memory directions | Four negative N–A estimates ( to ); all descriptive intervals span zero. |
| DeepSeek replication | Prospective confirmatory audit; five-probe memory directions | Four negative N–A estimates ( to ); all descriptive intervals lie below zero. |
| Qwen five-probe expansion | Post-hoc measurement robustness | 26/28 original directions retained; all reclassified allocation estimates remain negative. |
| DeepSeek inverse-pattern checks | Prespecified omissions; post-hoc sign-flip sensitivity | Every omission preserves the negative sign; max- -adjusted -values range from to . |
| Semantic re-identification | Post-hoc identity audit | Open-set entity recovery is 65.6% for Qwen and 79.2% for DeepSeek; directional associations vary across metrics. |
| Explicit-fact follow-up | Prospectively specified mechanism follow-up | Four small positive estimates ( – ), with intervals spanning zero and global max- ; final choices shift toward the supplied-fact company. |
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
| Analysis | Design and conditions | Sample | Measurements |
|---|---|---|---|
| Qwen memory accessibility | Closed book; two paraphrases per fact, before policy runs | 194 tasks; 126 facts; 252 probes | Recall within 5%; fact and task memory scores |
| Paired environments | N/A views of one canonical task | 48 tasks; 19 companies; 32 pairs; 77 future facts | Temporal validity; identifier, numeric, and retrieval parity |
| Qwen policy audit | Paired N/A; original two-probe directions | 96 valid trajectories; 28 asymmetric pairs | Memory-aligned K5, action, batch, and evidence contrasts |
| Familiarity diagnostics | Closed-book identity and pre-FY2018 revenue probes | 19 companies; 190 requests | Familiarity scores and familiarity-aligned allocation |
| Synthetic sensitivity | Evaluator-side transformations of fixed A sequences | 28 sequences; 1,000 transformations per grid cell | P1, K5, and batch interval-exclusion rates |
| Identity Cue study | Separate N/A/C runs; A and C share evidence | 144 scheduled; 143 valid; 47 complete triplets | Broad outcomes; raw and memory-aligned C–A allocation |
| (a) Fiscal periods and filing dates | ||
|---|---|---|
| Field | A: AMD | B: AMZN |
| FY2017 start | 2017-01-01 | 2017-01-01 |
| FY2017 end | 2017-12-30 | 2017-12-31 |
| FY2018 start | 2017-12-31 | 2018-01-01 |
| FY2018 end | 2018-12-29 | 2018-12-31 |
| FY2017 10-K available | 2018-02-27 | 2018-02-02 |
| Setting | Value |
|---|---|
| Ranker | BM25 |
| ; | 1.2; 0.75 |
| Returned hits | At most 10, positive scores only |
| Score ties | Fixed corpus chunk order |
| Snippet length | At most 220 characters |
| Identity normalization | Enabled in both conditions |
| Metric | N–A | 95% interval | |
|---|---|---|---|
| K5 | 37 | ||
| Action | 37 | ||
| Batch | 37 | ||
| Evidence | 36 |
| Setting | K5 median | K5 excl. | Batch median | Batch excl. | |
|---|---|---|---|---|---|
| Homogeneous | .02 | 0.0119 | 19.7% | 0.0124 | 79.6% |
| .05 | 0.0311 | 83.5% | 0.0321 | 100.0% | |
| .10 | 0.0638 | 99.7% | 0.0660 | 100.0% | |
| .15 | 0.1008 | 100.0% | 0.1021 | 100.0% | |
| .20 | 0.1368 | 100.0% | 0.1394 | 100.0% | |
| .30 | 0.2156 | 100.0% | 0.2154 | 100.0% |
| Metric | Natural | Raw | Max-T | interval | |
|---|---|---|---|---|---|
| K5 | .0149 | .0385 | |||
| Action/calls | .0014 | .0036 | |||
| Batch | .0025 | .0170 | |||
| Evidence | .0160 | .0337 |
| Model | Open entity | Open both | Closed entity | Open B–W | Closed B–W |
|---|---|---|---|---|---|
| Qwen | 63/96 (.656) | 19/48 (.396) | 88/96 (.917) | +.071 | +.071 |
| DeepSeek | 76/96 (.792) | 32/48 (.667) | 89/96 (.927) | .000 |
| Metric | Mean | 95% interval ( ) | One-sided | Max-T | Absolute | |
|---|---|---|---|---|---|---|
| K5 | 43 | +.0202 | .1762 | .3091 | +0.031 | |
| Action | 43 | +.0199 | .2410 | .3969 | +0.344 | |
| Batch | 43 | +.0386 | .0617 | .1327 | +0.344 | |
| Evidence | 25 | +.0112 | .4344 | .6156 | +0.302 |
| Model | Requested and returned identifier; Parasail endpoint |
|---|---|
| Qwen | qwen/qwen3.8-27b qwen/qwen3.8-27b-20260814 |
| DeepSeek | deepseek/deepseek-v4-flash-0731 deepseek/deepseek-v4-flash-20260731 |
LLM Agent Memory
Large language model agent memory lets agents retain, organize, retrieve, and update information across interactions and long-running tasks.
See all 368 papers